lots of sprintf -> snprintf and strcpy -> strlcpy; checked by tedu

42 files changed, 281 insertions, 206 deletions

diff --git a/bin/cp/cp.c b/bin/cp/cp.c
index 80222030835..ee8e50b7cea 100644
--- a/bin/cp/cp.c
+++ b/bin/cp/cp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cp.c,v 1.21 2003/01/06 01:52:52 millert Exp $	*/
+/*	$OpenBSD: cp.c,v 1.22 2003/03/13 09:09:20 deraadt Exp $	*/
 /*	$NetBSD: cp.c,v 1.14 1995/09/07 06:14:51 jtc Exp $	*/
 
 /*
@@ -47,7 +47,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)cp.c	8.5 (Berkeley) 4/29/95";
 #else
-static char rcsid[] = "$OpenBSD: cp.c,v 1.21 2003/01/06 01:52:52 millert Exp $";
+static char rcsid[] = "$OpenBSD: cp.c,v 1.22 2003/03/13 09:09:20 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -188,7 +188,7 @@ main(int argc, char *argv[])
 	target = argv[--argc];
 	if (strlen(target) >= sizeof(to.p_path))
 		errx(1, "%s: name too long", target);
-	(void)strcpy(to.p_path, target);
+	(void)strlcpy(to.p_path, target, sizeof to.p_path);
 	to.p_end = to.p_path + strlen(to.p_path);
 	if (to.p_path == to.p_end) {
 		*to.p_end++ = '.';
diff --git a/bin/mv/mv.c b/bin/mv/mv.c
index 43743409013..059fff2ba7d 100644
--- a/bin/mv/mv.c
+++ b/bin/mv/mv.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mv.c,v 1.24 2002/07/04 04:26:40 deraadt Exp $	*/
+/*	$OpenBSD: mv.c,v 1.25 2003/03/13 09:09:24 deraadt Exp $	*/
 /*	$NetBSD: mv.c,v 1.9 1995/03/21 09:06:52 cgd Exp $	*/
 
 /*
@@ -47,7 +47,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)mv.c	8.2 (Berkeley) 4/2/94";
 #else
-static char rcsid[] = "$OpenBSD: mv.c,v 1.24 2002/07/04 04:26:40 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: mv.c,v 1.25 2003/03/13 09:09:24 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -122,7 +122,7 @@ main(int argc, char *argv[])
 	/* It's a directory, move each file into it. */
 	if (strlen(argv[argc - 1]) > sizeof path - 1)
 		errx(1, "%s: destination pathname too long", *argv);
-	(void)strcpy(path, argv[argc - 1]);
+	(void)strlcpy(path, argv[argc - 1], sizeof path);
 	baselen = strlen(path);
 	endp = &path[baselen];
 	if (*(endp - 1) != '/') {
diff --git a/bin/rmail/rmail.c b/bin/rmail/rmail.c
index 6a19ca449aa..7e220b17ce5 100644
--- a/bin/rmail/rmail.c
+++ b/bin/rmail/rmail.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rmail.c,v 1.13 2002/07/04 04:26:40 deraadt Exp $	*/
+/*	$OpenBSD: rmail.c,v 1.14 2003/03/13 09:09:24 deraadt Exp $	*/
 /*	$NetBSD: rmail.c,v 1.8 1995/09/07 06:51:50 jtc Exp $	*/
 
 /*
@@ -44,7 +44,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)rmail.c	8.3 (Berkeley) 5/15/95";
 #else
-static char rcsid[] = "$OpenBSD: rmail.c,v 1.13 2002/07/04 04:26:40 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: rmail.c,v 1.14 2003/03/13 09:09:24 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -283,9 +283,11 @@ main(int argc, char *argv[])
 		if (strchr(*argv, ',') == NULL || strchr(*argv, '<') != NULL)
 			args[i++] = *argv;
 		else {
-			if ((args[i] = malloc(strlen(*argv) + 3)) == NULL)
+			int len = strlen(*argv) + 3;
+
+			if ((args[i] = malloc(len)) == NULL)
 				err(EX_TEMPFAIL, "Cannot malloc");
-			sprintf (args [i++], "<%s>", *argv);
+			snprintf(args[i++], len, "<%s>", *argv);
 		}
 		argv++;
 	}
diff --git a/sbin/dump/dumprmt.c b/sbin/dump/dumprmt.c
index 000d6fb5ca8..8eee75754fd 100644
--- a/sbin/dump/dumprmt.c
+++ b/sbin/dump/dumprmt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dumprmt.c,v 1.18 2002/02/21 16:16:26 millert Exp $	*/
+/*	$OpenBSD: dumprmt.c,v 1.19 2003/03/13 09:09:25 deraadt Exp $	*/
 /*	$NetBSD: dumprmt.c,v 1.17 1997/06/05 16:10:47 mrg Exp $	*/
 
 /*-
@@ -95,10 +95,11 @@ int
 rmthost(host)
 	char *host;
 {
+	int len = strlen(host) + 1;
 
-	rmtpeer = malloc(strlen(host) + 1);
+	rmtpeer = malloc(len);
 	if (rmtpeer)
-		strcpy(rmtpeer, host);
+		strlcpy(rmtpeer, host, len);
 	else
 		rmtpeer = host;
 	signal(SIGPIPE, rmtconnaborted);
diff --git a/sbin/fsck_msdos/dir.c b/sbin/fsck_msdos/dir.c
index 42f7fc48435..662b2f6ea48 100644
--- a/sbin/fsck_msdos/dir.c
+++ b/sbin/fsck_msdos/dir.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dir.c,v 1.15 2002/02/17 19:42:27 millert Exp $	*/
+/*	$OpenBSD: dir.c,v 1.16 2003/03/13 09:09:25 deraadt Exp $	*/
 /*	$NetBSD: dir.c,v 1.11 1997/10/17 11:19:35 ws Exp $	*/
 
 /*
@@ -37,7 +37,7 @@
 
 
 #ifndef lint
-static char rcsid[] = "$OpenBSD: dir.c,v 1.15 2002/02/17 19:42:27 millert Exp $";
+static char rcsid[] = "$OpenBSD: dir.c,v 1.16 2003/03/13 09:09:25 deraadt Exp $";
 #endif /* not lint */
 
 #include <stdio.h>
@@ -673,7 +673,7 @@ readDosDirSection(f, boot, fat, dir)
 				dirent.head |= (p[20] << 16) | (p[21] << 24);
 			dirent.size = p[28] | (p[29] << 8) | (p[30] << 16) | (p[31] << 24);
 			if (vallfn) {
-				strcpy(dirent.lname, longName);
+				strlcpy(dirent.lname, longName, sizeof dirent.lname);
 				longName[0] = '\0';
 				shortSum = -1;
 			}
diff --git a/sbin/modload/modload.c b/sbin/modload/modload.c
index be45711e3aa..eab4ae42bc5 100644
--- a/sbin/modload/modload.c
+++ b/sbin/modload/modload.c
@@ -1,4 +1,4 @@
-/* 	$OpenBSD: modload.c,v 1.37 2003/01/18 23:30:20 deraadt Exp $	*/
+/* 	$OpenBSD: modload.c,v 1.38 2003/03/13 09:09:26 deraadt Exp $	*/
 /*	$NetBSD: modload.c,v 1.30 2001/11/08 15:33:15 christos Exp $	*/
 
 /*
@@ -152,14 +152,15 @@ static int
 verify_entry(const char *entry, char *filename)
 {
 	struct	nlist	names[2];
-	int n;
+	int n, len;
 	char *s;
 
 	memset(names, 0, sizeof(names));
-	s = malloc(strlen(entry) + 2);
+	len = strlen(entry) + 2;
+	s = malloc(len);
 	if (s == NULL)
 		err(1, "malloc");
-	sprintf(s, "_%s", entry);	/* safe */
+	snprintf(s, len, "_%s", entry);
 #ifdef	_AOUT_INCLUDE_
 	names[0].n_un.n_name = s;
 #else
@@ -315,14 +316,17 @@ main(int argc, char *argv[])
 		 * Try <modobj>_init if entry is DFLT_ENTRY.
 		 */
 		if (strcmp(entry, DFLT_ENTRY) == 0) {
+			int len;
+
 			if ((p = strrchr(modout, '/')))
 				p++;
 			else
 				p = modout;
-			entry = malloc(strlen(p) + strlen(DFLT_ENTRYEXT) + 1);
+			len = strlen(p) + strlen(DFLT_ENTRYEXT) + 1;
+			entry = malloc(len);
 			if (entry == NULL)
 				err(1, "malloc");
-			sprintf(entry, "%s%s", p, DFLT_ENTRYEXT); /* safe */
+			snprintf(entry, len, "%s%s", p, DFLT_ENTRYEXT);
 			if (verify_entry(entry, modobj))
 				errx(1, "entry point _%s not found in %s",
 				    entry, modobj);
diff --git a/sbin/mountd/mountd.c b/sbin/mountd/mountd.c
index 74b675d7ad0..bb5f6026889 100644
--- a/sbin/mountd/mountd.c
+++ b/sbin/mountd/mountd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mountd.c,v 1.54 2003/03/09 00:30:24 deraadt Exp $	*/
+/*	$OpenBSD: mountd.c,v 1.55 2003/03/13 09:09:26 deraadt Exp $	*/
 /*	$NetBSD: mountd.c,v 1.31 1996/02/18 11:57:53 fvdl Exp $	*/
 
 /*
@@ -833,13 +833,15 @@ get_exportlist(void)
 				     */
 				    ep = ex_search(&fsb.f_fsid);
 				    if (ep == NULL) {
+					int len;
+
 					ep = get_exp();
 					ep->ex_fs = fsb.f_fsid;
-					ep->ex_fsdir = (char *)
-					    malloc(strlen(fsb.f_mntonname) + 1);
+					len = strlen(fsb.f_mntonname) + 1;
+					ep->ex_fsdir = (char *)malloc(len);
 					if (ep->ex_fsdir)
-					    strcpy(ep->ex_fsdir,
-						fsb.f_mntonname);
+					    strlcpy(ep->ex_fsdir,
+					        fsb.f_mntonname, len);
 					else
 					    out_of_mem();
 					if (debug)
@@ -1093,14 +1095,14 @@ add_expdir(struct dirlist **dpp, char *cp, int len)
 {
 	struct dirlist *dp;
 
-	dp = (struct dirlist *)malloc(sizeof (struct dirlist) + len);
+	dp = (struct dirlist *)malloc(sizeof (struct dirlist) + len + 1);
 	if (dp == NULL)
 		out_of_mem();
 	dp->dp_left = *dpp;
 	dp->dp_right = NULL;
 	dp->dp_flag = 0;
 	dp->dp_hosts = NULL;
-	strcpy(dp->dp_dirp, cp);
+	strlcpy(dp->dp_dirp, cp, len);	/* might be 1 byte extra */
 	*dpp = dp;
 	return (dp->dp_dirp);
 }
@@ -1692,14 +1694,17 @@ get_net(char *cp, struct netmsk *net, int maskflg)
 	if (maskflg)
 		net->nt_mask = inetaddr.s_addr;
 	else {
+		int len;
+
 		if (np)
 			name = np->n_name;
 		else
 			name = inet_ntoa(inetaddr);
-		net->nt_name = (char *)malloc(strlen(name) + 1);
+		len = strlen(name) + 1;
+		net->nt_name = (char *)malloc(len);
 		if (net->nt_name == NULL)
 			out_of_mem();
-		strcpy(net->nt_name, name);
+		strlcpy(net->nt_name, name, len);
 		net->nt_net = inetaddr.s_addr;
 	}
 	return (0);
diff --git a/sbin/newfs/newfs.c b/sbin/newfs/newfs.c
index db1ceb4403d..7ab1d2755aa 100644
--- a/sbin/newfs/newfs.c
+++ b/sbin/newfs/newfs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: newfs.c,v 1.35 2002/05/26 09:24:35 deraadt Exp $	*/
+/*	$OpenBSD: newfs.c,v 1.36 2003/03/13 09:09:26 deraadt Exp $	*/
 /*	$NetBSD: newfs.c,v 1.20 1996/05/16 07:13:03 thorpej Exp $	*/
 
 /*
@@ -44,7 +44,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)newfs.c	8.8 (Berkeley) 4/18/94";
 #else
-static char rcsid[] = "$OpenBSD: newfs.c,v 1.35 2002/05/26 09:24:35 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: newfs.c,v 1.36 2003/03/13 09:09:26 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -589,7 +589,7 @@ havelabel:
 	if (mfs) {
 		struct mfs_args args;
 
-		sprintf(buf, "mfs:%ld", (long)getpid());
+		snprintf(buf, sizeof buf, "mfs:%ld", (long)getpid());
 		args.fspec = buf;
 		args.export_info.ex_root = -2;
 		if (mntflags & MNT_RDONLY)
diff --git a/sbin/quotacheck/quotacheck.c b/sbin/quotacheck/quotacheck.c
index 3093983ce1d..9b9c4444962 100644
--- a/sbin/quotacheck/quotacheck.c
+++ b/sbin/quotacheck/quotacheck.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: quotacheck.c,v 1.15 2003/03/11 02:32:31 deraadt Exp $	*/
+/*	$OpenBSD: quotacheck.c,v 1.16 2003/03/13 09:09:27 deraadt Exp $	*/
 /*	$NetBSD: quotacheck.c,v 1.12 1996/03/30 22:34:25 mark Exp $	*/
 
 /*
@@ -47,7 +47,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)quotacheck.c	8.3 (Berkeley) 1/29/94";
 #else
-static char rcsid[] = "$OpenBSD: quotacheck.c,v 1.15 2003/03/11 02:32:31 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: quotacheck.c,v 1.16 2003/03/13 09:09:27 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -552,7 +552,8 @@ addid(u_long id, int type, char *name)
 	if (name)
 		memcpy(fup->fu_name, name, len + 1);
 	else
-		(void)sprintf(fup->fu_name, "%lu", id);
+		(void)snprintf(fup->fu_name, len, "%lu",
+		    id); /* 1 byte extra */
 	return (fup);
 }
 
diff --git a/sbin/raidctl/raidctl.c b/sbin/raidctl/raidctl.c
index 57f2d8f3db7..aa4fe894098 100644
--- a/sbin/raidctl/raidctl.c
+++ b/sbin/raidctl/raidctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raidctl.c,v 1.18 2002/06/09 08:13:09 todd Exp $	*/
+/*	$OpenBSD: raidctl.c,v 1.19 2003/03/13 09:09:27 deraadt Exp $	*/
 /*      $NetBSD: raidctl.c,v 1.27 2001/07/10 01:30:52 lukem Exp $   */
 
 /*-
@@ -1244,8 +1244,10 @@ get_all_devices(diskarray, genericname)
 	fp = disks;
 	while ((p = strsep(&fp, ",")) != NULL) {
 		if (strstr((const char*)p, genericname) != NULL) {
-			(*diskarray)[i] = (char*) malloc(strlen(p) + 6);
-			sprintf((*diskarray)[i++], "/dev/%s%c", p,
+			int len = strlen(p) + 6;
+
+			(*diskarray)[i] = (char*) malloc(len);
+			snprintf((*diskarray)[i++], len, "/dev/%s%c", p,
 				'a' + getrawpartition());
 		}
 	}
diff --git a/sbin/raidctl/rf_configure.c b/sbin/raidctl/rf_configure.c
index 365be0f38b5..f9b63bcf13b 100644
--- a/sbin/raidctl/rf_configure.c
+++ b/sbin/raidctl/rf_configure.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rf_configure.c,v 1.10 2002/12/16 07:01:33 tdeval Exp $	*/
+/*	$OpenBSD: rf_configure.c,v 1.11 2003/03/13 09:09:27 deraadt Exp $	*/
 /*	$NetBSD: rf_configure.c,v 1.14 2001/02/04 21:05:42 christos Exp $	*/
 
 /*
@@ -538,8 +538,8 @@ rf_ReadSpareTable(req, fname)
   if (buf[strlen(buf)-1] == '\n')
     buf[strlen(buf)-1] = '\0';
 
-  sprintf(targString, "fdisk %d\n", req->fcol);
-	sprintf(errString,
+	snprintf(targString, sizeof targString, "fdisk %d\n", req->fcol);
+	snprintf(errString, sizeof errString,
 	    "Invalid sparemap file:  can't find \"fdisk %d\" line\n",
 	    req->fcol);
   while (1) {
diff --git a/sbin/route/route.c b/sbin/route/route.c
index 91b81cf0fe2..29263782c4d 100644
--- a/sbin/route/route.c
+++ b/sbin/route/route.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: route.c,v 1.55 2003/03/11 02:32:31 deraadt Exp $	*/
+/*	$OpenBSD: route.c,v 1.56 2003/03/13 09:09:27 deraadt Exp $	*/
 /*	$NetBSD: route.c,v 1.16 1996/04/15 18:27:05 cgd Exp $	*/
 
 /*
@@ -44,7 +44,7 @@ static const char copyright[] =
 #if 0
 static const char sccsid[] = "@(#)route.c	8.3 (Berkeley) 3/19/94";
 #else
-static const char rcsid[] = "$OpenBSD: route.c,v 1.55 2003/03/11 02:32:31 deraadt Exp $";
+static const char rcsid[] = "$OpenBSD: route.c,v 1.56 2003/03/13 09:09:27 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -1200,7 +1200,7 @@ ns_print(struct sockaddr_ns *sns)
 	if (ns_nullhost(work) && net.long_e == 0) {
 		if (!port)
 			return ("*.*");
-		(void) sprintf(mybuf, "*.0x%x", port);
+		(void) snprintf(mybuf, sizeof mybuf, "*.0x%x", port);
 		return (mybuf);
 	}
 
@@ -1210,12 +1210,12 @@ ns_print(struct sockaddr_ns *sns)
 		host = "*";
 	else {
 		q = work.x_host.c_host;
-		(void) sprintf(chost, "0x%02x%02x%02x%02x%02x%02x",
+		(void) snprintf(chost, sizeof chost, "0x%02x%02x%02x%02x%02x%02x",
 			q[0], q[1], q[2], q[3], q[4], q[5]);
 		host = chost;
 	}
 	if (port)
-		(void) sprintf(cport, ".0x%x", htons(port));
+		(void) snprintf(cport, sizeof cport, ".0x%x", htons(port));
 	else
 		*cport = '\0';
 
@@ -1245,7 +1245,7 @@ ipx_print(struct sockaddr_ipx *sipx)
 	if (ipx_nullhost(work) && net.long_e == 0) {
 		if (!port)
 			return ("*.*");
-		(void) sprintf(mybuf, "*.0x%XH", port);
+		(void) snprintf(mybuf, sizeof mybuf, "*.0x%XH", port);
 		return (mybuf);
 	}
 
@@ -1255,14 +1255,14 @@ ipx_print(struct sockaddr_ipx *sipx)
 		host = "*";
 	else {
 		q = work.ipx_host.c_host;
-		(void) sprintf(chost, "%02X%02X%02X%02X%02X%02XH",
+		(void) snprintf(chost, sizeof chost, "%02X%02X%02X%02X%02X%02XH",
 			q[0], q[1], q[2], q[3], q[4], q[5]);
 		for (p = chost; *p == '0' && p < chost + 12; p++)
 			/* void */;
 		host = p;
 	}
 	if (port)
-		(void) sprintf(cport, ".%XH", htons(port));
+		(void) snprintf(cport, sizeof cport, ".%XH", htons(port));
 	else
 		*cport = 0;
 
diff --git a/sbin/route/show.c b/sbin/route/show.c
index 43dd527fad4..6812db4b816 100644
--- a/sbin/route/show.c
+++ b/sbin/route/show.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: show.c,v 1.21 2002/02/16 21:27:37 millert Exp $	*/
+/*	$OpenBSD: show.c,v 1.22 2003/03/13 09:09:27 deraadt Exp $	*/
 /*	$NetBSD: show.c,v 1.1 1996/11/15 18:01:41 gwr Exp $	*/
 
 /*
@@ -38,7 +38,7 @@
 #if 0
 static char sccsid[] = "from: @(#)route.c	8.3 (Berkeley) 3/9/94";
 #else
-static char *rcsid = "$OpenBSD: show.c,v 1.21 2002/02/16 21:27:37 millert Exp $";
+static char *rcsid = "$OpenBSD: show.c,v 1.22 2003/03/13 09:09:27 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -305,6 +305,7 @@ p_sockaddr(sa, flags, width)
 {
 	char workbuf[128], *cplim;
 	char *cp = workbuf;
+	int len = sizeof workbuf;
 
 	switch(sa->sa_family) {
 
@@ -314,25 +315,32 @@ p_sockaddr(sa, flags, width)
 
 		if (sdl->sdl_nlen == 0 && sdl->sdl_alen == 0 &&
 		    sdl->sdl_slen == 0)
-			(void) sprintf(workbuf, "link#%d", sdl->sdl_index);
-		else switch (sdl->sdl_type) {
-		case IFT_ETHER:
-		    {
-			int i;
-			u_char *lla = (u_char *)sdl->sdl_data +
-			    sdl->sdl_nlen;
-
-			cplim = "";
-			for (i = 0; i < sdl->sdl_alen; i++, lla++) {
-				cp += sprintf(cp, "%s%x", cplim, *lla);
-				cplim = ":";
+			(void) snprintf(workbuf, sizeof workbuf,
+			    "link#%d", sdl->sdl_index);
+		else {
+			switch (sdl->sdl_type) {
+			case IFT_ETHER:
+			    {
+				int i;
+				u_char *lla = (u_char *)sdl->sdl_data +
+				    sdl->sdl_nlen;
+
+				cplim = "";
+				for (i = 0; i < sdl->sdl_alen; i++, lla++) {
+					snprintf(cp, len, "%s%x", cplim, *lla);
+					len -= strlen(cp);
+					cp += strlen(cp);
+					if (len <= 0)
+						break;	/* overflow */
+					cplim = ":";
+				}
+				cp = workbuf;
+				break;
+			    }
+			default:
+				cp = link_ntoa(sdl);
+				break;
 			}
-			cp = workbuf;
-			break;
-		    }
-		default:
-			cp = link_ntoa(sdl);
-			break;
 		}
 		break;
 	    }
@@ -373,11 +381,26 @@ p_sockaddr(sa, flags, width)
 
 		slim =  sa->sa_len + (u_char *) sa;
 		cplim = cp + sizeof(workbuf) - 6;
-		cp += sprintf(cp, "(%d)", sa->sa_family);
+		snprintf(cp, len, "(%d)", sa->sa_family);
+		len -= strlen(cp);
+		cp += strlen(cp);
+		if (len <= 0) {
+			cp = workbuf;
+			break;		/* overflow */
+		}
 		while (s < slim && cp < cplim) {
-			cp += sprintf(cp, " %02x", *s++);
-			if (s < slim)
-				cp += sprintf(cp, "%02x", *s++);
+			snprintf(cp, len, " %02x", *s++);
+			len -= strlen(cp);
+			cp += strlen(cp);
+			if (len <= 0)
+				break;		/* overflow */
+			if (s < slim) {
+				snprintf(cp, len, "%02x", *s++);
+				len -= strlen(cp);
+				cp += strlen(cp);
+				if (len <= 0)
+					break;		/* overflow */
+			}
 		}
 		cp = workbuf;
 	    }
diff --git a/sbin/routed/parms.c b/sbin/routed/parms.c
index 994810f7e88..5e2d110e448 100644
--- a/sbin/routed/parms.c
+++ b/sbin/routed/parms.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parms.c,v 1.7 2002/08/08 14:00:24 aaron Exp $	*/
+/*	$OpenBSD: parms.c,v 1.8 2003/03/13 09:09:27 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1983, 1993
@@ -386,13 +386,14 @@ parse_parms(char *line)
 			    || tok[3] == '\0'
 			    || strlen(tok) > IFNAMSIZ+3)
 				break;
-			strcpy(parm.parm_name, tok+3);
+			strlcpy(parm.parm_name, tok+3, sizeof parm.parm_name);
 
 		} else if (PARSE("passwd")) {
 			if (tok[7] == '\0'
 			    || strlen(tok) > RIP_AUTH_PW_LEN+7)
 				break;
-			strcpy(parm.parm_passwd, tok+7);
+			strlcpy(parm.parm_passwd, tok+7,
+			    sizeof parm.parm_passwd);
 
 		} else if (PARS("no_ag")) {
 			parm.parm_int_state |= (IS_NO_AG | IS_NO_SUPER_AG);
diff --git a/sbin/routed/table.c b/sbin/routed/table.c
index 44a82e2555f..1f0075ea849 100644
--- a/sbin/routed/table.c
+++ b/sbin/routed/table.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: table.c,v 1.9 2003/03/13 06:10:49 deraadt Exp $	*/
+/*	$OpenBSD: table.c,v 1.10 2003/03/13 09:09:27 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1983, 1988, 1993
@@ -1088,7 +1088,8 @@ read_rt(void)
 			continue;
 		}
 
-		strcpy(str, rtm_type_name(m.r.rtm.rtm_type));
+		strlcpy(str, rtm_type_name(m.r.rtm.rtm_type),
+		    sizeof str);
 		strp = &str[strlen(str)];
 		if (m.r.rtm.rtm_type <= RTM_CHANGE)
 			strp += sprintf(strp," from pid %ld", (long)m.r.rtm.rtm_pid);
diff --git a/sbin/routed/trace.c b/sbin/routed/trace.c
index 45ef94f5189..10d4cc5a810 100644
--- a/sbin/routed/trace.c
+++ b/sbin/routed/trace.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: trace.c,v 1.9 2001/09/05 22:32:38 deraadt Exp $	*/
+/*	$OpenBSD: trace.c,v 1.10 2003/03/13 09:09:27 deraadt Exp $	*/
 /*	$NetBSD: trace.c,v 1.13 1995/06/20 22:28:03 christos Exp $	*/
 
 /*
@@ -37,7 +37,7 @@
 #if !defined(lint)
 static char sccsid[] = "@(#)trace.c	8.1 (Berkeley) 6/5/93";
 #else
-static char rcsid[] = "$OpenBSD: trace.c,v 1.9 2001/09/05 22:32:38 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: trace.c,v 1.10 2003/03/13 09:09:27 deraadt Exp $";
 #endif
 
 #define	RIPCMDS
@@ -74,13 +74,13 @@ naddr_ntoa(naddr a)
 	static struct {
 	    char    str[16];		/* xxx.xxx.xxx.xxx\0 */
 	} bufs[NUM_BUFS];
-	char *s;
 	struct in_addr addr;
 
 	addr.s_addr = a;
-	s = strcpy(bufs[bufno].str, inet_ntoa(addr));
+	strlcpy(bufs[bufno].str, inet_ntoa(addr),
+	    sizeof bufs[bufno].str);
 	bufno = (bufno+1) % NUM_BUFS;
-	return s;
+	return bufs[bufno].str;
 #undef NUM_BUFS
 }
 
@@ -344,8 +344,10 @@ addrname(naddr	addr,			/* in network byte order */
 	naddr dmask;
 	int i;
 
-	s = strcpy(bufs[bufno].str, naddr_ntoa(addr));
+	strlcpy(bufs[bufno].str, naddr_ntoa(addr),
+	    sizeof bufs[bufno].str);
 	bufno = (bufno+1) % NUM_BUFS;
+	s = bufs[bufno].str;
 
 	if (force == 1 || (force == 0 && mask != std_mask(addr))) {
 		sp = &s[strlen(s)];
@@ -485,8 +487,10 @@ trace_pair(naddr dst,
 			+3*4+3+1];	/* "xxx.xxx.xxx.xxx" */
 	int i;
 
-	i = sprintf(buf, "%-16s-->", addrname(dst, mask, 0));
-	(void)sprintf(&buf[i], "%-*s", 15+20-MAX(20,i), gate);
+	i = snprintf(buf, sizeof buf, "%-16s-->", addrname(dst, mask, 0));
+	if (i >= sizeof buf)
+		return buf;
+	(void)snprintf(&buf[i], sizeof buf - i, "%-*s", 15+20-MAX(20,i), gate);
 	return buf;
 }
 
diff --git a/usr.bin/calendar/io.c b/usr.bin/calendar/io.c
index 4dbbcfbf3bb..b52e728ba14 100644
--- a/usr.bin/calendar/io.c
+++ b/usr.bin/calendar/io.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: io.c,v 1.21 2002/12/18 20:34:44 mickey Exp $	*/
+/*	$OpenBSD: io.c,v 1.22 2003/03/13 09:09:29 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1989, 1993, 1994
@@ -43,7 +43,7 @@ static const char copyright[] =
 #if 0
 static const char sccsid[] = "@(#)calendar.c  8.3 (Berkeley) 3/25/94";
 #else
-static char rcsid[] = "$OpenBSD: io.c,v 1.21 2002/12/18 20:34:44 mickey Exp $";
+static char rcsid[] = "$OpenBSD: io.c,v 1.22 2003/03/13 09:09:29 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -178,10 +178,11 @@ cal(void)
 					if (m->bodun && prefix) {
 						int l1 = strlen(prefix);
 						int l2 = strlen(p);
+						int len = l1 + l2 + 2;
 						if ((cur_evt->ldesc =
-						    malloc(l1 + l2 + 2)) == NULL)
+						    malloc(len)) == NULL)
 							err(1, "malloc");
-						sprintf(cur_evt->ldesc,
+						snprintf(cur_evt->ldesc, len,
 						    "\t%s %s", prefix, p + 1);
 					} else if ((cur_evt->ldesc =
 					    strdup(p)) == NULL)
diff --git a/usr.bin/cdio/cddb.c b/usr.bin/cdio/cddb.c
index d7e8e75218d..4b9c91906e3 100644
--- a/usr.bin/cdio/cddb.c
+++ b/usr.bin/cdio/cddb.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cddb.c,v 1.5 2002/12/14 21:28:08 espie Exp $ */
+/* $OpenBSD: cddb.c,v 1.6 2003/03/13 09:09:29 deraadt Exp $ */
 /*
  * Copyright (c) 2002 Marc Espie.
  *
@@ -79,7 +79,7 @@ send_hello(FILE *cout)
 	char hostname[MAXHOSTNAMELEN];
 
 	if (gethostname(hostname, sizeof(hostname)) == -1)
-		strcpy(hostname, "unknown");
+		strlcpy(hostname, "unknown", sizeof hostname);
 	fprintf(cout, "CDDB HELLO %s %s cdio " VERSION "\r\n",
 	    getlogin(), hostname);
 	fflush(cout);
@@ -106,11 +106,11 @@ safe_copy(char **p, const char *title)
 	if (*p == NULL)
 		*p = strdup(copy_buffer);
 	else {
-		char *n = malloc(strlen(*p) + strlen(copy_buffer) + 1);
+		int len = strlen(*p) + strlen(copy_buffer) + 1;
+		char *n = malloc(len);
 		if (n == NULL)
 			return;
-		strcpy(n, *p);
-		strcat(n, copy_buffer);
+		snprintf(n, len, "%s%s", *p, copy_buffer);
 		free(*p);
 		*p = n;
 	}
diff --git a/usr.bin/hexdump/conv.c b/usr.bin/hexdump/conv.c
index 5c2e0da330d..7c9c6e7e944 100644
--- a/usr.bin/hexdump/conv.c
+++ b/usr.bin/hexdump/conv.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conv.c,v 1.4 2001/12/30 08:17:32 pvalchev Exp $	*/
+/*	$OpenBSD: conv.c,v 1.5 2003/03/13 09:09:31 deraadt Exp $	*/
 /*	$NetBSD: conv.c,v 1.7 2001/12/07 15:14:29 bjh21 Exp $	*/
 
 /*
@@ -36,7 +36,7 @@
 
 #ifndef lint
 /*static char sccsid[] = "from: @(#)conv.c	5.4 (Berkeley) 6/1/90";*/
-static char rcsid[] = "$OpenBSD: conv.c,v 1.4 2001/12/30 08:17:32 pvalchev Exp $";
+static char rcsid[] = "$OpenBSD: conv.c,v 1.5 2003/03/13 09:09:31 deraadt Exp $";
 #endif /* not lint */
 
 #include <sys/types.h>
@@ -91,7 +91,7 @@ conv_c(pr, p)
 		*pr->cchar = 'c';
 		(void)printf(pr->fmt, *p);
 	} else {
-		(void)sprintf(buf, "%03o", (int)*p);
+		(void)snprintf(buf, sizeof buf, "%03o", (int)*p);
 		str = buf;
 strpr:		*pr->cchar = 's';
 		(void)printf(pr->fmt, str);
diff --git a/usr.bin/less/charset.c b/usr.bin/less/charset.c
index 04b4f83ed4a..979435e283b 100644
--- a/usr.bin/less/charset.c
+++ b/usr.bin/less/charset.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: charset.c,v 1.3 2001/11/19 19:02:14 mpech Exp $	*/
+/*	$OpenBSD: charset.c,v 1.4 2003/03/13 09:09:32 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1984,1985,1989,1994,1995  Mark Nudelman
@@ -278,12 +278,12 @@ prchar(c)
 
 	c &= 0377;
 	if (!control_char(c))
-		sprintf(buf, "%c", c);
+		snprintf(buf, sizeof buf, "%c", c);
 	else if (c == ESC)
-		sprintf(buf, "ESC");
+		snprintf(buf, sizeof buf, "ESC");
 	else if (c < 128 && !control_char(c ^ 0100))
-		sprintf(buf, "^%c", c ^ 0100);
+		snprintf(buf, sizeof buf, "^%c", c ^ 0100);
 	else
-		sprintf(buf, binfmt, c);
+		snprintf(buf, sizeof buf, binfmt, c);
 	return (buf);
 }
diff --git a/usr.bin/less/filename.c b/usr.bin/less/filename.c
index 28bacff3278..71dc429e756 100644
--- a/usr.bin/less/filename.c
+++ b/usr.bin/less/filename.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: filename.c,v 1.3 2001/11/19 19:02:14 mpech Exp $	*/
+/*	$OpenBSD: filename.c,v 1.4 2003/03/13 09:09:32 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1984,1985,1989,1994,1995  Mark Nudelman
@@ -51,21 +51,21 @@ dirfile(dirname, filename)
 	char *filename;
 {
 	char *pathname;
-	int f;
+	int f, len;
 
 	if (dirname == NULL || *dirname == '\0')
 		return (NULL);
 	/*
 	 * Construct the full pathname.
 	 */
-	pathname = (char *) calloc(strlen(dirname) + strlen(filename) + 2, 
-					sizeof(char));
+	len = strlen(dirname) + strlen(filename) + 2;
+	pathname = (char *) calloc(len, sizeof(char));
 	if (pathname == NULL)
 		return (NULL);
 #if MSOFTC || OS2
 	sprintf(pathname, "%s\\%s", dirname, filename);
 #else
-	sprintf(pathname, "%s/%s", dirname, filename);
+	snprintf(pathname, len, "%s/%s", dirname, filename);
 #endif
 	/*
 	 * Make sure the file exists.
@@ -239,7 +239,7 @@ fcomplete(s)
 		sprintf(fpat, "%s*", s);
 #else
 	fpat = (char *) ecalloc(strlen(s)+2, sizeof(char));
-	sprintf(fpat, "%s*", s);
+	snprintf(fpat, strlen(s)+2, "%s*", s);
 #endif
 	s = glob(fpat);
 	if (strcmp(s,fpat) == 0)
@@ -360,7 +360,7 @@ shellcmd(cmd, s1, s2)
 		(s1 == NULL ? 0 : strlen(s1)) + 
 		(s2 == NULL ? 0 : strlen(s2)) + 1;
 	scmd = (char *) ecalloc(len, sizeof(char));
-	sprintf(scmd, cmd, s1, s2);
+	snprintf(scmd, len, cmd, s1, s2);
 #if HAVE_SHELL
 	shell = getenv("SHELL");
 	if (shell != NULL && *shell != '\0')
@@ -368,9 +368,9 @@ shellcmd(cmd, s1, s2)
 		/*
 		 * Read the output of <$SHELL -c "cmd">.
 		 */
-		scmd2 = (char *) ecalloc(strlen(shell) + strlen(scmd) + 7,
-					sizeof(char));
-		sprintf(scmd2, "%s -c \"%s\"", shell, scmd);
+		len = strlen(shell) + strlen(scmd) + 7;
+		scmd2 = (char *) ecalloc(len, sizeof(char));
+		snprintf(scmd2, len, "%s -c \"%s\"", shell, scmd);
 		free(scmd);
 		scmd = scmd2;
 	}
diff --git a/usr.bin/less/option.c b/usr.bin/less/option.c
index ad44cb60af6..694c2baac70 100644
--- a/usr.bin/less/option.c
+++ b/usr.bin/less/option.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: option.c,v 1.3 2001/11/19 19:02:14 mpech Exp $	*/
+/*	$OpenBSD: option.c,v 1.4 2003/03/13 09:09:32 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1984,1985,1989,1994,1995  Mark Nudelman
@@ -408,7 +408,7 @@ propt(c)
 {
 	static char buf[8];
 
-	sprintf(buf, "-%s", prchar(c));
+	snprintf(buf, sizeof buf, "-%s", prchar(c));
 	return (buf);
 }
 
diff --git a/usr.bin/less/os.c b/usr.bin/less/os.c
index 27953952806..c4235f81979 100644
--- a/usr.bin/less/os.c
+++ b/usr.bin/less/os.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: os.c,v 1.4 2001/11/19 19:02:14 mpech Exp $	*/
+/*	$OpenBSD: os.c,v 1.5 2003/03/13 09:09:32 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1984,1985,1989,1994,1995  Mark Nudelman
@@ -162,7 +162,7 @@ strerror(err)
   
 	if (err < sys_nerr)
 		return sys_errlist[err];
-	sprintf(buf, "Error %d", err);
+	snprintf(buf, sizeof buf, "Error %d", err);
 	return buf;
 #else
 	return ("cannot open");
@@ -179,14 +179,16 @@ errno_message(filename)
 {
 	char *p;
 	char *m;
+	int len;
 #if HAVE_ERRNO
 	extern int errno;
 	p = strerror(errno);
 #else
 	p = "cannot open";
 #endif
-	m = (char *) ecalloc(strlen(filename) + strlen(p) + 3, sizeof(char));
-	sprintf(m, "%s: %s", filename, p);
+	len = strlen(filename) + strlen(p) + 3;
+	m = (char *) ecalloc(len, sizeof(char));
+	snprintf(m, len, "%s: %s", filename, p);
 	return (m);
 }
 
diff --git a/usr.bin/man/man.c b/usr.bin/man/man.c
index e4ffe0e03ca..21177aa6e46 100644
--- a/usr.bin/man/man.c
+++ b/usr.bin/man/man.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: man.c,v 1.23 2002/12/08 16:50:07 millert Exp $	*/
+/*	$OpenBSD: man.c,v 1.24 2003/03/13 09:09:32 deraadt Exp $	*/
 /*	$NetBSD: man.c,v 1.7 1995/09/28 06:05:34 tls Exp $	*/
 
 /*
@@ -44,7 +44,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)man.c	8.17 (Berkeley) 1/31/95";
 #else
-static char rcsid[] = "$OpenBSD: man.c,v 1.23 2002/12/08 16:50:07 millert Exp $";
+static char rcsid[] = "$OpenBSD: man.c,v 1.24 2003/03/13 09:09:32 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -696,6 +696,7 @@ static char *
 check_pager(char *name)
 {
 	char *p, *save;
+	int len;
 
 	/*
 	 * if the user uses "more", we make it "more -s"; watch out for
@@ -712,10 +713,10 @@ check_pager(char *name)
 	if (!strncmp(p, "more", 4) && (!p[4] || isspace(p[4]))){
 		save = name;
 		/* allocate space to add the "-s" */
-		if (!(name =
-		    malloc(strlen(save) + 1 + sizeof("-s"))))
+		len = strlen(save) + 1 + sizeof("-s");
+		if (!(name =malloc(len)))
 			err(1, NULL);
-		(void)sprintf(name, "%s %s", save, "-s");
+		(void)snprintf(name, len, "%s %s", save, "-s");
 	}
 	return(name);
 }
diff --git a/usr.bin/msgs/msgs.c b/usr.bin/msgs/msgs.c
index a63bd906d44..15f6ce22eb5 100644
--- a/usr.bin/msgs/msgs.c
+++ b/usr.bin/msgs/msgs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: msgs.c,v 1.23 2002/08/08 11:55:07 ho Exp $	*/
+/*	$OpenBSD: msgs.c,v 1.24 2003/03/13 09:09:33 deraadt Exp $	*/
 /*	$NetBSD: msgs.c,v 1.7 1995/09/28 06:57:40 tls Exp $	*/
 
 /*-
@@ -44,7 +44,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)msgs.c	8.2 (Berkeley) 4/28/95";
 #else
-static char rcsid[] = "$OpenBSD: msgs.c,v 1.23 2002/08/08 11:55:07 ho Exp $";
+static char rcsid[] = "$OpenBSD: msgs.c,v 1.24 2003/03/13 09:09:33 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -145,7 +145,7 @@ void prmesg(int);
 void onintr(int);
 void onsusp(int);
 int linecnt(FILE *);
-int next(char *);
+int next(char *, int);
 void ask(char *);
 void gfrsub(FILE *);
 char *nxtfld(char *);
@@ -590,7 +590,7 @@ cmnd:
 					break;
 				}
 				if (isdigit(*in)) {
-					msg = next(in);
+					msg = next(in, sizeof inbuf);
 					sep = in;
 					break;
 				}
@@ -742,12 +742,13 @@ linecnt(f)
 }
 
 int
-next(buf)
+next(buf, len)
 	char *buf;
+	int len;
 {
 	int i;
 	sscanf(buf, "%d", &i);
-	sprintf(buf, "Goto %d", i);
+	snprintf(buf, len, "Goto %d", i);
 	return(--i);
 }
 
diff --git a/usr.bin/netstat/inet6.c b/usr.bin/netstat/inet6.c
index be54955a356..f9e4a6cc487 100644
--- a/usr.bin/netstat/inet6.c
+++ b/usr.bin/netstat/inet6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inet6.c,v 1.25 2003/02/01 01:51:31 deraadt Exp $	*/
+/*	$OpenBSD: inet6.c,v 1.26 2003/03/13 09:09:33 deraadt Exp $	*/
 /*	BSDI inet.c,v 2.3 1995/10/24 02:19:29 prb Exp	*/
 /*
  * Copyright (c) 1983, 1988, 1993
@@ -38,7 +38,7 @@
 #if 0
 static char sccsid[] = "@(#)inet.c	8.4 (Berkeley) 4/20/94";
 #else
-/*__RCSID("$OpenBSD: inet6.c,v 1.25 2003/02/01 01:51:31 deraadt Exp $");*/
+/*__RCSID("$OpenBSD: inet6.c,v 1.26 2003/03/13 09:09:33 deraadt Exp $");*/
 /*__RCSID("KAME Id: inet6.c,v 1.10 2000/02/09 10:49:31 itojun Exp");*/
 #endif
 #endif /* not lint */
@@ -1044,21 +1044,27 @@ inet6print(struct in6_addr *in6, int port, char *proto)
 	struct servent *sp = 0;
 	char line[80], *cp;
 	int width;
+	int len = sizeof line;
 
 	width = Aflag ? 12 : 16;
 	if (vflag && width < strlen(inet6name(in6)))
 		width = strlen(inet6name(in6));
-	snprintf(line, sizeof line, "%.*s.", width, inet6name(in6));
-	cp = strchr(line, '\0');
+	snprintf(line, len, "%.*s.", width, inet6name(in6));
+	len -= strlen(line);
+	if (len <= 0)
+		goto bail;
+
+	cp += len;
 	if (!nflag && port)
 		GETSERVBYPORT6(port, proto, sp);
 	if (sp || port == 0)
-		sprintf(cp, "%.8s", sp ? sp->s_name : "*");
+		snprintf(cp, len, "%.8s", sp ? sp->s_name : "*");
 	else
-		sprintf(cp, "%d", ntohs((u_short)port));
+		snprintf(cp, len, "%d", ntohs((u_short)port));
 	width = Aflag ? 18 : 22;
 	if (vflag && width < strlen(line))
 		width = strlen(line);
+bail:
 	printf(" %-*.*s", width, width, line);
 }
 
diff --git a/usr.bin/rpcgen/rpc_cout.c b/usr.bin/rpcgen/rpc_cout.c
index 6430b78249f..be22d6a5982 100644
--- a/usr.bin/rpcgen/rpc_cout.c
+++ b/usr.bin/rpcgen/rpc_cout.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rpc_cout.c,v 1.13 2002/07/05 05:39:42 deraadt Exp $	*/
+/*	$OpenBSD: rpc_cout.c,v 1.14 2003/03/13 09:09:34 deraadt Exp $	*/
 /*	$NetBSD: rpc_cout.c,v 1.6 1996/10/01 04:13:53 cgd Exp $	*/
 /*
  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
@@ -354,17 +354,19 @@ emit_union(def)
 			continue;
 		cs = &cl->case_decl;
 		if (!streq(cs->type, "void")) {
-			object = alloc(strlen(def->def_name) + strlen(format) +
-			    strlen(cs->name) + 1);
+			int len = strlen(def->def_name) + strlen(format) +
+			    strlen(cs->name) + 1;
+
+			object = alloc(len);
 			if (object == NULL) {
 				fprintf(stderr, "Fatal error : no memory\n");
 				crash();
 			}
 			if (isvectordef(cs->type, cs->rel)) {
-				sprintf(object, vecformat, def->def_name,
+				snprintf(object, len, vecformat, def->def_name,
 				    cs->name);
 			} else {
-				sprintf(object, format, def->def_name,
+				snprintf(object, len, format, def->def_name,
 				    cs->name);
 			}
 			print_ifstat(2, cs->prefix, cs->type, cs->rel, cs->array_max,
@@ -376,18 +378,20 @@ emit_union(def)
 	dflt = def->def.un.default_decl;
 	if (dflt != NULL) {
 		if (!streq(dflt->type, "void")) {
+			int len = strlen(def->def_name) + strlen(format) +
+			    strlen(dflt->name) + 1;
+
 			fprintf(fout, "\tdefault:\n");
-			object = alloc(strlen(def->def_name) + strlen(format) +
-			    strlen(dflt->name) + 1);
+			object = alloc(len);
 			if (object == NULL) {
 				fprintf(stderr, "Fatal error : no memory\n");
 				crash();
 			}
 			if (isvectordef(dflt->type, dflt->rel)) {
-				sprintf(object, vecformat, def->def_name,
+				snprintf(object, len, vecformat, def->def_name,
 				    dflt->name);
 			} else {
-				sprintf(object, format, def->def_name,
+				snprintf(object, len, format, def->def_name,
 				    dflt->name);
 			}
 
diff --git a/usr.bin/tftp/main.c b/usr.bin/tftp/main.c
index 574b1983aba..5f0f6756519 100644
--- a/usr.bin/tftp/main.c
+++ b/usr.bin/tftp/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.10 2002/02/16 21:27:55 millert Exp $	*/
+/*	$OpenBSD: main.c,v 1.11 2003/03/13 09:09:35 deraadt Exp $	*/
 /*	$NetBSD: main.c,v 1.6 1995/05/21 16:54:10 mycroft Exp $	*/
 
 /*
@@ -44,7 +44,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)main.c	8.1 (Berkeley) 6/6/93";
 #endif
-static char rcsid[] = "$OpenBSD: main.c,v 1.10 2002/02/16 21:27:55 millert Exp $";
+static char rcsid[] = "$OpenBSD: main.c,v 1.11 2003/03/13 09:09:35 deraadt Exp $";
 #endif /* not lint */
 
 /* Many bug fixes are from Jim Guyton <guyton@rand-unix> */
@@ -172,7 +172,7 @@ main(argc, argv)
 	s_in.sin_family = AF_INET;
 	if (bind(f, (struct sockaddr *)&s_in, sizeof (s_in)) < 0)
 		err(1, "tftp: bind");
-	strcpy(mode, "netascii");
+	strlcpy(mode, "netascii", sizeof mode);
 	signal(SIGINT, intr);
 	if (argc > 1) {
 		if (setjmp(toplevel) != 0)
@@ -195,7 +195,7 @@ setpeer(argc, argv)
 	struct hostent *host;
 
 	if (argc < 2) {
-		strcpy(line, "Connect ");
+		strlcpy(line, "Connect ", sizeof line);
 		printf("(to) ");
 		fgets(&line[strlen(line)], LBUFLEN-strlen(line), stdin);
 		if (makeargv())
@@ -220,7 +220,7 @@ setpeer(argc, argv)
 		}
 		peeraddr.sin_family = host->h_addrtype;
 		bcopy(host->h_addr, &peeraddr.sin_addr, host->h_length);
-		(void) strcpy(hostname, host->h_name);
+		(void) strlcpy(hostname, host->h_name, sizeof hostname);
 	}
 	port = sp->s_port;
 	if (argc == 3) {
@@ -305,7 +305,7 @@ static void
 settftpmode(newmode)
 	char *newmode;
 {
-	strcpy(mode, newmode);
+	strlcpy(mode, newmode, sizeof mode);
 	if (verbose)
 		printf("mode set to %s\n", mode);
 }
@@ -324,7 +324,7 @@ put(argc, argv)
 	char *cp, *targ;
 
 	if (argc < 2) {
-		strcpy(line, "send ");
+		strlcpy(line, "send ", sizeof line);
 		printf("(file) ");
 		fgets(&line[strlen(line)], LBUFLEN-strlen(line), stdin);
 		if (makeargv())
@@ -357,7 +357,7 @@ put(argc, argv)
 		bcopy(hp->h_addr, (caddr_t)&peeraddr.sin_addr, hp->h_length);
 		peeraddr.sin_family = hp->h_addrtype;
 		connected = 1;
-		strcpy(hostname, hp->h_name);
+		strlcpy(hostname, hp->h_name, sizeof hostname);
 	}
 	if (!connected) {
 		printf("No target machine specified.\n");
@@ -418,7 +418,7 @@ get(argc, argv)
 	char *src;
 
 	if (argc < 2) {
-		strcpy(line, "get ");
+		strlcpy(line, "get ", sizeof line);
 		printf("(files) ");
 		fgets(&line[strlen(line)], LBUFLEN-strlen(line), stdin);
 		if (makeargv())
@@ -454,7 +454,7 @@ get(argc, argv)
 			    hp->h_length);
 			peeraddr.sin_family = hp->h_addrtype;
 			connected = 1;
-			strcpy(hostname, hp->h_name);
+			strlcpy(hostname, hp->h_name, sizeof hostname);
 		}
 		if (argc < 4) {
 			cp = argc == 3 ? argv[2] : tail(src);
@@ -502,7 +502,7 @@ setrexmt(argc, argv)
 	int t;
 
 	if (argc < 2) {
-		strcpy(line, "Rexmt-timeout ");
+		strlcpy(line, "Rexmt-timeout ", sizeof line);
 		printf("(value) ");
 		fgets(&line[strlen(line)], LBUFLEN-strlen(line), stdin);
 		if (makeargv())
@@ -531,7 +531,7 @@ settimeout(argc, argv)
 	int t;
 
 	if (argc < 2) {
-		strcpy(line, "Maximum-timeout ");
+		strlcpy(line, "Maximum-timeout ", sizeof line);
 		printf("(value) ");
 		fgets(&line[strlen(line)], LBUFLEN-strlen(line), stdin);
 		if (makeargv())
diff --git a/usr.bin/vacation/vacation.c b/usr.bin/vacation/vacation.c
index df8edaa2e31..c301b89e1da 100644
--- a/usr.bin/vacation/vacation.c
+++ b/usr.bin/vacation/vacation.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vacation.c,v 1.17 2002/02/16 21:27:56 millert Exp $	*/
+/*	$OpenBSD: vacation.c,v 1.18 2003/03/13 09:09:36 deraadt Exp $	*/
 /*	$NetBSD: vacation.c,v 1.7 1995/04/29 05:58:27 cgd Exp $	*/
 
 /*
@@ -44,7 +44,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)vacation.c	8.2 (Berkeley) 1/26/94";
 #endif
-static char rcsid[] = "$OpenBSD: vacation.c,v 1.17 2002/02/16 21:27:56 millert Exp $";
+static char rcsid[] = "$OpenBSD: vacation.c,v 1.18 2003/03/13 09:09:36 deraadt Exp $";
 #endif /* not lint */
 
 /*
@@ -224,7 +224,7 @@ readheaders()
 				for (p = buf + 5; *p && *p != ' '; ++p)
 					;
 				*p = '\0';
-				(void)strcpy(from, buf + 5);
+				(void)strlcpy(from, buf + 5, sizeof from);
 				if ((p = strchr(from, '\n')))
 					*p = '\0';
 				if (junkmail())
diff --git a/usr.bin/yacc/reader.c b/usr.bin/yacc/reader.c
index 4cc0a181dca..25eff52cca8 100644
--- a/usr.bin/yacc/reader.c
+++ b/usr.bin/yacc/reader.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: reader.c,v 1.11 2002/06/14 21:35:00 todd Exp $	*/
+/*	$OpenBSD: reader.c,v 1.12 2003/03/13 09:09:37 deraadt Exp $	*/
 
 /*	$NetBSD: reader.c,v 1.5 1996/03/19 03:21:43 jtc Exp $	*/
 
@@ -1275,7 +1275,7 @@ insert_empty_rule()
     bucket *bp, **bpp;
 
     assert(cache);
-    sprintf(cache, "$$%d", ++gensym);
+    snprintf(cache, cache_size, "$$%d", ++gensym);
     bp = make_bucket(cache);
     last_symbol->next = bp;
     last_symbol = bp;
diff --git a/usr.sbin/ac/ac.c b/usr.sbin/ac/ac.c
index cae5625f1d0..84516eb27ea 100644
--- a/usr.sbin/ac/ac.c
+++ b/usr.sbin/ac/ac.c
@@ -14,7 +14,7 @@
  */
 
 #ifndef lint
-static char rcsid[] = "$Id: ac.c,v 1.12 2002/05/30 19:09:05 deraadt Exp $";
+static char rcsid[] = "$Id: ac.c,v 1.13 2003/03/13 09:09:37 deraadt Exp $";
 #endif
 
 #include <sys/types.h>
@@ -514,7 +514,7 @@ ac(fp)
 	(void)fclose(fp);
 	if (!(Flags & AC_W))
 		usr.ut_time = time((time_t *)0);
-	(void)strcpy(usr.ut_line, "~");
+	(void)strlcpy(usr.ut_line, "~", sizeof usr.ut_line);
 
 	if (Flags & AC_D) {
 		ltm = localtime(&usr.ut_time);
diff --git a/usr.sbin/bootpd/getether.c b/usr.sbin/bootpd/getether.c
index e47664c9d24..efcc3074eea 100644
--- a/usr.sbin/bootpd/getether.c
+++ b/usr.sbin/bootpd/getether.c
@@ -39,8 +39,9 @@ getether(ifname, eap)
 	int rc = -1;
 	int fd;
 	struct ifdevea phys;
+
 	bzero(&phys, sizeof(phys));
-	strcpy(phys.ifr_name, ifname);
+	strlcpy(phys.ifr_name, ifname, sizeof phys.ifr_name);
 	if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
 		report(LOG_ERR, "getether: socket(INET,DGRAM) failed");
 		return -1;
@@ -335,8 +336,9 @@ getether(ifname, eap)
 	int rc = -1;
 	int fd;
 	struct ifreq phys;
+
 	bzero(&phys, sizeof(phys));
-	strcpy(phys.ifr_name, ifname);
+	strlcpy(phys.ifr_name, ifname, sizeof phys.ifr_name);
 	if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
 		report(LOG_ERR, "getether: socket(INET,DGRAM) failed");
 		return -1;
diff --git a/usr.sbin/bootpd/readfile.c b/usr.sbin/bootpd/readfile.c
index ad8913d0bbf..abf4a27ae03 100644
--- a/usr.sbin/bootpd/readfile.c
+++ b/usr.sbin/bootpd/readfile.c
@@ -21,7 +21,7 @@ SOFTWARE.
 ************************************************************************/
 
 #ifndef lint
-static char rcsid[] = "$Id: readfile.c,v 1.7 2002/12/06 02:17:42 deraadt Exp $";
+static char rcsid[] = "$Id: readfile.c,v 1.8 2003/03/13 09:09:45 deraadt Exp $";
 #endif
 
 
@@ -1223,14 +1223,15 @@ get_shared_string(src)
 	char retstring[MAXSTRINGLEN];
 	struct shared_string *s;
 	unsigned int length;
+	int len;
 
 	length = sizeof(retstring);
 	(void) get_string(src, retstring, &length);
 
-	s = (struct shared_string *) smalloc(sizeof(struct shared_string)
-										 + length);
+	len = sizeof(struct shared_string) + length;
+	s = (struct shared_string *) smalloc(len);
 	s->linkcount = 1;
-	strcpy(s->string, retstring);
+	strlcpy(s->string, retstring, len);
 
 	return s;
 }
diff --git a/usr.sbin/edquota/edquota.c b/usr.sbin/edquota/edquota.c
index b959ccfd141..dfc093cc9ef 100644
--- a/usr.sbin/edquota/edquota.c
+++ b/usr.sbin/edquota/edquota.c
@@ -42,7 +42,7 @@ static char copyright[] =
 
 #ifndef lint
 /*static char sccsid[] = "from: @(#)edquota.c	8.1 (Berkeley) 6/6/93";*/
-static char *rcsid = "$Id: edquota.c,v 1.35 2002/09/06 21:49:21 deraadt Exp $";
+static char *rcsid = "$Id: edquota.c,v 1.36 2003/03/13 09:09:46 deraadt Exp $";
 #endif /* not lint */
 
 /*
@@ -365,14 +365,15 @@ editit(tmpfile)
 	char *argp[] = {"sh", "-c", NULL, NULL};
 	char *ed, *p;
 	sigset_t mask, omask;
-	int stat;
+	int stat, len;
 
 	if ((ed = getenv("EDITOR")) == (char *)0)
 		ed = _PATH_VI;
-	p = (char *)malloc(strlen(ed) + 1 + strlen(tmpfile) + 1);
+	len = strlen(ed) + 1 + strlen(tmpfile) + 1;
+	p = (char *)malloc(len);
 	if (!p)
 		return(0);
-	(void)sprintf(p, "%s %s", ed, tmpfile);
+	(void)snprintf(p, len, "%s %s", ed, tmpfile);
 	argp[2] = p;
 
 	sigemptyset(&mask);
diff --git a/usr.sbin/faithd/faithd.c b/usr.sbin/faithd/faithd.c
index 7808f018a00..6bb06d0c6f7 100644
--- a/usr.sbin/faithd/faithd.c
+++ b/usr.sbin/faithd/faithd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: faithd.c,v 1.22 2002/09/08 01:20:15 itojun Exp $	*/
+/*	$OpenBSD: faithd.c,v 1.23 2003/03/13 09:09:46 deraadt Exp $	*/
 /*	$KAME: faithd.c,v 1.58 2002/09/08 01:12:30 itojun Exp $	*/
 
 /*
@@ -259,22 +259,29 @@ daemon_main(int argc, char **argv)
 		usage();
 		/*NOTREACHED*/
 	default:
+	    {
+		int len;
+
 		serverargc = argc - NUMARG;
 		if (serverargc >= MAXARGV)
 			exit_stderr("too many arguments");
 
-		serverpath = malloc(strlen(argv[NUMPRG]) + 1);
+		len = strlen(argv[NUMPRG]) + 1;
+		serverpath = malloc(len);
 		if (!serverpath)
 			exit_stderr("not enough core");
-		strcpy(serverpath, argv[NUMPRG]);
+		strlcpy(serverpath, argv[NUMPRG], len);
 		for (i = 0; i < serverargc; i++) {
-			serverarg[i] = malloc(strlen(argv[i + NUMARG]) + 1);
+			int len = strlen(argv[i + NUMARG]) + 1;
+
+			serverarg[i] = malloc(len);
 			if (!serverarg[i])
 				exit_stderr("not enough core");
-			strcpy(serverarg[i], argv[i + NUMARG]);
+			strlcpy(serverarg[i], argv[i + NUMARG], len);
 		}
 		serverarg[i] = NULL;
 		/* fall throuth */
+	    }
 	case 1:	/* no local service */
 		service = argv[NUMPRT];
 		break;
diff --git a/usr.sbin/lpr/pac/pac.c b/usr.sbin/lpr/pac/pac.c
index ddd91e400c2..9fcd52207d9 100644
--- a/usr.sbin/lpr/pac/pac.c
+++ b/usr.sbin/lpr/pac/pac.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pac.c,v 1.15 2002/06/14 21:35:01 todd Exp $ */
+/*	$OpenBSD: pac.c,v 1.16 2003/03/13 09:09:48 deraadt Exp $ */
 /*	$NetBSD: pac.c,v 1.14 2000/04/27 13:40:18 msaitoh Exp $	*/
 
 /*
@@ -45,7 +45,7 @@ static const char copyright[] =
 #if 0
 static const char sccsid[] = "@(#)pac.c	8.1 (Berkeley) 6/6/93";
 #else
-static const char rcsid[] = "$OpenBSD: pac.c,v 1.15 2002/06/14 21:35:01 todd Exp $";
+static const char rcsid[] = "$OpenBSD: pac.c,v 1.16 2003/03/13 09:09:48 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -444,6 +444,7 @@ static int
 chkprinter(const char *s)
 {
 	int stat;
+	int len;
 
 	if ((stat = cgetent(&bp, printcapdb, s)) == -2) {
 		printf("pac: can't open printer description file\n");
@@ -459,11 +460,12 @@ chkprinter(const char *s)
 	}
 	if (!pflag && (cgetnum(bp, "pc", &price100) == 0))
 		price = price100/10000.0;
-	sumfile = (char *) malloc(strlen(acctfile) + 5);
+	len = strlen(acctfile) + 5;
+	sumfile = (char *) malloc(len);
 	if (sumfile == NULL)
 		err(1, "pac");
-	strcpy(sumfile, acctfile);	/* safe */
-	strcat(sumfile, "_sum");	/* safe */
+	strlcpy(sumfile, acctfile, len);
+	strlcat(sumfile, "_sum", len);
 	return(1);
 }
 
diff --git a/usr.sbin/memconfig/memconfig.c b/usr.sbin/memconfig/memconfig.c
index bdd182ad516..2712b6055d1 100644
--- a/usr.sbin/memconfig/memconfig.c
+++ b/usr.sbin/memconfig/memconfig.c
@@ -1,4 +1,5 @@
-/* $OpenBSD: memconfig.c,v 1.6 2002/10/14 21:01:01 matthieu Exp $ */
+/* $OpenBSD: memconfig.c,v 1.7 2003/03/13 09:09:48 deraadt Exp $ */
+
 /*-
  * Copyright (c) 1999 Michael Smith <msmith@freebsd.org>
  * All rights reserved.
@@ -211,7 +212,7 @@ setfunc(memfd, argc, argv)
 	mrd.mr_base = 0;
 	mrd.mr_len = 0;
 	mrd.mr_flags = 0;
-	strcpy(mrd.mr_owner, "user");
+	strlcpy(mrd.mr_owner, "user", sizeof mrd.mr_owner);
 	while ((ch = getopt(argc, argv, "b:l:o:")) != -1)
 		switch(ch) {
 		case 'b':
@@ -228,7 +229,7 @@ setfunc(memfd, argc, argv)
 			if (*optarg == 0 ||
 			    strlen(optarg) > sizeof(mrd.mr_owner)-1)
 				help("set");
-			strcpy(mrd.mr_owner, optarg);
+			strlcpy(mrd.mr_owner, optarg, sizeof mrd.mr_owner);
 			break;
 
 		case '?':
diff --git a/usr.sbin/mrouted/rsrr.c b/usr.sbin/mrouted/rsrr.c
index 10b3670ee88..22c0f2ed94f 100644
--- a/usr.sbin/mrouted/rsrr.c
+++ b/usr.sbin/mrouted/rsrr.c
@@ -94,7 +94,7 @@ rsrr_init()
     unlink(RSRR_SERV_PATH);
     bzero((char *) &serv_addr, sizeof(serv_addr));
     serv_addr.sun_family = AF_UNIX;
-    strcpy(serv_addr.sun_path, RSRR_SERV_PATH);
+    strlcpy(serv_addr.sun_path, RSRR_SERV_PATH, sizeof serv_addr.sun_path);
 #if (defined(BSD) && (BSD >= 199103))
     servlen = offsetof(struct sockaddr_un, sun_path) +
 		strlen(serv_addr.sun_path);
@@ -444,7 +444,8 @@ rsrr_cache(gt,route_query)
     rc->route_query.source_addr.s_addr = route_query->source_addr.s_addr;
     rc->route_query.dest_addr.s_addr = route_query->dest_addr.s_addr;
     rc->route_query.query_id = route_query->query_id;
-    strcpy(rc->client_addr.sun_path, client_addr.sun_path);
+    strlcpy(rc->client_addr.sun_path, client_addr.sun_path,
+	sizeof rc->client_addr.sun_path);
     rc->client_length = client_length;
     rc->next = gt->gt_rsrr_cache;
     gt->gt_rsrr_cache = rc;
diff --git a/usr.sbin/mtrace/mtrace.c b/usr.sbin/mtrace/mtrace.c
index 9ec63249cb0..fd2f631b02a 100644
--- a/usr.sbin/mtrace/mtrace.c
+++ b/usr.sbin/mtrace/mtrace.c
@@ -52,7 +52,7 @@
 
 #ifndef lint
 static char rcsid[] =
-    "@(#) $Id: mtrace.c,v 1.15 2002/08/09 02:12:15 itojun Exp $";
+    "@(#) $Id: mtrace.c,v 1.16 2003/03/13 09:09:49 deraadt Exp $";
 #endif
 
 #include <netdb.h>
@@ -232,7 +232,7 @@ proto_type(type)
       case PROTO_CBT:
 	return ("CBT");
       default:
-	(void) sprintf(buf, "Unknown protocol code %d", type);
+	(void) snprintf(buf, sizeof buf, "Unknown protocol code %d", type);
 	return (buf);
     }
 }
@@ -264,7 +264,7 @@ flag_type(type)
       case TR_NO_SPACE:
 	return ("No space in packet");
       default:
-	(void) sprintf(buf, "Unknown error code %d", type);
+	(void) snprintf(buf, sizeof buf, "Unknown error code %d", type);
 	return (buf);
     }
 }    
@@ -910,14 +910,14 @@ stat_line(r, s, have_next, rst)
 	if (v_out) v_pct = (v_lost * 100 + (v_out >> 1)) / v_out;
 	else v_pct = 0;
 	if (-100 < v_pct && v_pct < 101 && v_out > 10)
-	  sprintf(v_str, "%3d", v_pct);
+	  snprintf(v_str, sizeof v_str, "%3d", v_pct);
 	else memcpy(v_str, " --", 4);
 
 	g_lost = g_out - (ntohl(s->tr_pktcnt) - ntohl(r->tr_pktcnt));
 	if (g_out) g_pct = (g_lost * 100 + (g_out >> 1))/ g_out;
 	else g_pct = 0;
 	if (-100 < g_pct && g_pct < 101 && g_out > 10)
-	  sprintf(g_str, "%3d", g_pct);
+	  snprintf(g_str, sizeof g_str, "%3d", g_pct);
 	else memcpy(g_str, " --", 4);
 
 	printf("%6d/%-5d=%s%%%4d pps",
diff --git a/usr.sbin/rtsold/rtsold.c b/usr.sbin/rtsold/rtsold.c
index 2e0301db5d8..30b0a1ac41f 100644
--- a/usr.sbin/rtsold/rtsold.c
+++ b/usr.sbin/rtsold/rtsold.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtsold.c,v 1.26 2002/10/26 20:23:20 itojun Exp $	*/
+/*	$OpenBSD: rtsold.c,v 1.27 2003/03/13 09:09:50 deraadt Exp $	*/
 /*	$KAME: rtsold.c,v 1.57 2002/09/20 21:59:55 itojun Exp $	*/
 
 /*
@@ -789,7 +789,7 @@ autoifprobe()
 	static char **argv = NULL;
 	static int n = 0;
 	char **a;
-	int i, found;
+	int i, found, len;
 	struct ifaddrs *ifap, *ifa, *target;
 
 	/* initialize */
@@ -837,10 +837,11 @@ autoifprobe()
 		if (a == NULL)
 			err(1, "realloc");
 		argv = a;
-		argv[n] = (char *)malloc(1 + strlen(ifa->ifa_name));
+		len = 1 + strlen(ifa->ifa_name);
+		argv[n] = (char *)malloc(len);
 		if (!argv[n])
 			err(1, "malloc");
-		strcpy(argv[n], ifa->ifa_name);
+		strlcpy(argv[n], ifa->ifa_name, len);
 		n++;
 	}
 
diff --git a/usr.sbin/ypserv/revnetgroup/parse_netgroup.c b/usr.sbin/ypserv/revnetgroup/parse_netgroup.c
index 042152c9f6a..9e6bb7d334b 100644
--- a/usr.sbin/ypserv/revnetgroup/parse_netgroup.c
+++ b/usr.sbin/ypserv/revnetgroup/parse_netgroup.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: parse_netgroup.c,v 1.6 2002/12/09 00:45:38 millert Exp $ */
+/* $OpenBSD: parse_netgroup.c,v 1.7 2003/03/13 09:09:51 deraadt Exp $ */
 /*
  * Copyright (c) 1992, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -51,7 +51,7 @@
 #include "hash.h"
 
 #ifndef lint
-static const char rcsid[] = "$OpenBSD: parse_netgroup.c,v 1.6 2002/12/09 00:45:38 millert Exp $";
+static const char rcsid[] = "$OpenBSD: parse_netgroup.c,v 1.7 2003/03/13 09:09:51 deraadt Exp $";
 #endif
 
 /*
@@ -298,7 +298,7 @@ read_for_group(char *group)
 	char *data = NULL;
 
 	data = lookup (gtable, group);
-	sprintf(line, "%s %s", group, data);
+	snprintf(line, sizeof line, "%s %s", group, data);
 	pos = (char *)&line;
 #ifdef CANT_HAPPEN
 	if (*pos == '#')
diff --git a/usr.sbin/ypserv/stdethers/stdethers.c b/usr.sbin/ypserv/stdethers/stdethers.c
index 52690bc9a61..1bafed0b6c2 100644
--- a/usr.sbin/ypserv/stdethers/stdethers.c
+++ b/usr.sbin/ypserv/stdethers/stdethers.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: stdethers.c,v 1.6 2002/07/19 20:59:40 deraadt Exp $ */
+/*	$OpenBSD: stdethers.c,v 1.7 2003/03/13 09:09:51 deraadt Exp $ */
 
 /*
  * Copyright (c) 1995 Mats O Jansson <moj@stacken.kth.se>
@@ -32,7 +32,7 @@
  */
 
 #ifndef LINT
-static char rcsid[] = "$OpenBSD: stdethers.c,v 1.6 2002/07/19 20:59:40 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: stdethers.c,v 1.7 2003/03/13 09:09:51 deraadt Exp $";
 #endif
 
 #include <sys/types.h>
@@ -62,7 +62,7 @@ working_ntoa(u_char *e)
 {
 	static char a[] = "xx:xx:xx:xx:xx:xx";
 
-	sprintf(a, "%x:%x:%x:%x:%x:%x",
+	snprintf(a, sizeof a, "%x:%x:%x:%x:%x:%x",
 	    e[0], e[1], e[2], e[3], e[4], e[5]);
 	return a;
 }